01584711a119595a55d80eb89763aaca | Triage

Sharing

Copy URL Twitter E-mail

General

Target

01584711a119595a55d80eb89763aaca
Size

17KB
MD5

01584711a119595a55d80eb89763aaca
SHA1

88b84dcc0b061aff49a86a28cbf72264a4a6fdda
SHA256

7e14969591c1a92efcfde4153c637909299c6742516b2bd11d357276424c3ac2
SHA512

3f359e98a153aa29337edda8808f67c87f52bc8cd6f775717f56501f83d9410a605daa817a654c158a8f61f4a79b7090257fe618aa92c484eed6f5948e694389
SSDEEP

384:pnN4ZZ3OVz48Pefj3IS1KGhddAl0yp/kQo3CfoFqUNYe:pnN4zMvesST7ibp/LxAFqUB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01584711a119595a55d80eb89763aaca

Files

01584711a119595a55d80eb89763aaca
.dll windows:4 windows x86 arch:x86

00cd8b0fcd86082f590a23d0ecf418f4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
GetCurrentProcessId
FreeLibrary
GetTempPathA
GetWindowsDirectoryA
CreateMutexA
lstrcatA
CreateThread
DisableThreadLibraryCalls
GetCurrentProcess
LoadLibraryA
ExitProcess
Sleep
GetProcAddress

user32

GetWindowTextA
PostMessageA
GetForegroundWindow
wsprintfA
keybd_event
FindWindowExA

advapi32

DeleteService
LookupPrivilegeValueA

msvcrt

fopen
printf
fscanf
fclose
??2@YAPAXI@Z

Exports

Exports

CompareLinkInfoReferents
CompareLinkInfoVolumes
CreateLinkInfo
CreateLinkInfoA
CreateLinkInfoW
DestroyLinkInfo
DisconnectLinkInfo
GetCanonicalPathInfo
GetCanonicalPathInfoA
GetCanonicalPathInfoW
GetLinkInfoData
IsValidLinkInfo
ResolveLinkInfo
ResolveLinkInfoA
ResolveLinkInfoW
Rsll

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 794B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ